Cyber Attacks on Protective Relays in Digital Substations and Impact Analysis

Conference paper (2020)

Authors

Vetrivel Subramaniam Rajkumar Intelligent Electrical Power Grids - EEMCS
M. Tealane Talinn University of Technology
Alexandru Stefanov Intelligent Electrical Power Grids - EEMCS
P. Palensky Intelligent Electrical Power Grids - EEMCS
Research Group
Intelligent Electrical Power Grids (EEMCS) (TU Delft)
Copyright: © 2020 Vetrivel Subramaniam Rajkumar, M. Tealane, Alexandru Stefanov, P. Palensky
DOI: https://doi.org/10.1109/MSCPES49613.2020.9133698
Cyber Security Cyber-Physical Systems IEC 61850 Cyber attacks Cascading Failures
More Info
expand_more

Published Date

2020

Language

English

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Faculty

Electrical Engineering, Mathematics and Computer Science

Department

Electrical Sustainable Energy

Research Group

Intelligent Electrical Power Grids

Abstract

Power systems automation and communication standards are crucial for the transition of the conventional power system towards a smart grid. The IEC 61850 standard is widely used for substation automation and protection. It enables real-time communication and data exchange between critical substation automation devices. IEC 61850 serves as the foundation for open communication and data exchange for digital substations of the smart grid. However, IEC 61850 has cyber security vulnerabilities that can be exploited with a man-in-the-middle attack. Such coordinated cyber attacks against the protection system in digital substations can disconnect generation and transmission lines, causing cascading failures. In this paper, we demonstrate a cyber attack involving the Generic Object-Oriented Substation Event (GOOSE) protocol of IEC 61850. This is achieved by exploiting the cyber security vulnerabilities in the protocol and injecting spoofed GOOSE data frames into the substation communication network at the bay level. The cyber attack leads to tripping of multiple protective relays in the power grid, eventually resulting in a blackout. The attack model and impact on system dynamics are verified experimentally through hardware-in-the-loop simulations using commercial relays and Real-Time Digital Simulator (RTDS).